CVE-2022-26306

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which weakens the security of the encryption making them vulnerable if an attacker has access to the user's configuration data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.

• CWE-326
• CWE-330

• http://www.openwall.com/lists/oss-security/2022/08/13/1Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306Vendor Advisory
• http://www.openwall.com/lists/oss-security/2022/08/13/1Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00022.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/cve-2022-26306Vendor Advisory

Published

Jul 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26300EOS v2.1.0 was discovered to contain a heap-buffer-overflow …7.5
• CVE-2022-26301TuziCMS v2.0.6 was discovered to contain a SQL injection vul…9.8
• CVE-2022-26302Heap-based buffer overflow exists in the simulator module co…7.8
• CVE-2022-26303An external config control vulnerability exists in the OAS E…7.5
• CVE-2022-26304Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2022-26305An Improper Certificate Validation vulnerability in LibreOff…7.5
• CVE-2022-26307LibreOffice supports the storage of passwords for web connec…8.8
• CVE-2022-26308Pandora FMS v7.0NG.760 and below allows an improper access c…5.4
• CVE-2022-26309Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in …8.8
• CVE-2022-2631Improper Access Control in GitHub repository tooljet/tooljet…8.8
• CVE-2022-26310Pandora FMS v7.0NG.760 and below allows an improper authoriz…8.8
• CVE-2022-26311Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Info…7.5